RISKEN MCP Server

The RISKEN MCP Server is a Model Context Protocol (MCP) server that provides seamless integration with RISKEN APIs, enabling advanced automation and interaction capabilities for developers and tools.

Use Cases

By connecting the RISKEN MCP server to your everyday AI tools, you can perform various operations such as:

• Checking active alerts in RISKEN and monitoring their status.
• Searching, analyzing, and reviewing findings including their explanations and remediation steps.
• Archiving resolved findings to maintain a clean and organized security posture.

Prerequisites

1. To run the server in a container, you will need to have Docker installed.
2. Once Docker is installed, you will also need to ensure Docker is running.
3. You will also need to have a RISKEN Access Token.

Local MCP Server

Please add the following MCP server configuration to your MCP Client (Claude Desktop or Cursor) settings.

{
  "mcpServers": {
    "risken": {
      "command": "docker",
      "args": [
        "run",
        "-i",
        "--rm",
        "-e",
        "RISKEN_ACCESS_TOKEN",
        "-e",
        "RISKEN_URL",
        "ghcr.io/ca-risken/risken-mcp-server",
        "stdio"
      ],
      "env": {
        "RISKEN_URL": "http://localhost:8098",
        "RISKEN_ACCESS_TOKEN": "your_access_token"
      }
    }
  }
}

Remote MCP Server

RISKEN MCP Server supports Streamable HTTP.

on Local

docker run -it --rm \
  -e RISKEN_URL=http://localhost:8098 \
  -e RISKEN_ACCESS_TOKEN=xxxxxx \
  -p 8080:8080 \
  ghcr.io/ca-risken/risken-mcp-server http

on Cloud Run

You can deploy the server on Google Cloud Run with Terraform.

1. Visit terraform/examples/googlecloud and deploy the server on Google Cloud Run with Terraform.

2. Add the following MCP server configuration to your MCP Client (Claude Desktop or Cursor) settings.

Note: Since most MCP clients only allow stdio connections, it is currently necessary to use mcp-remote as a proxy to connect to remote MCP servers.

Claude Desktop, Cursor ...

{
  "mcpServers": {
    "risken": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "http://localhost:8098/mcp",
        "--header",
        "RISKEN-ACCESS-TOKEN:${RISKEN_ACCESS_TOKEN}"
      ],
      "env": {
        "RISKEN_ACCESS_TOKEN": "xxxxxx"
      }
    }
  }
}

Third-Party Authorization (OAuth2.1)

RISKEN MCP Server supports Third-Party Authorization (OAuth2.1) that enables secure authentication through external Identity Providers (IdP).

Overview

The OAuth2.1 implementation follows the MCP Authorization specification with Third-Party Authorization Flow, where:

1. MCP Client initiates OAuth flow with MCP Server
2. MCP Server acts as authorization server and redirects user to IdP
3. IdP authenticates user and returns to MCP Server
4. MCP Server issues access token for MCP Client
5. MCP Client uses access token for subsequent MCP requests

OAuth Flow

sequenceDiagram
    participant Browser as User Browser
    participant Client as MCP Client
    participant Server as MCP Server
    participant IdP as Identity Provider

    Client->>Server: POST /mcp (no auth)
    Server->>Client: 401 Unauthorized + WWW-Authenticate
    Client->>Server: GET /.well-known/oauth-authorization-server
    Server->>Client: Authorization metadata
    Client->>Server: POST /register (Dynamic Client Registration)
    Server->>Client: client_id
    Clie

... [View full README on GitHub](https://github.com/ca-risken/risken-mcp-server#readme)